"parse error. not well formed"

08Jan08

I’m hoping Google users will find this post if they search for the following Windows Live Writer error message:

An unexpected error has occurred while attempting to log in:

Blog Server Error – Server Error -32700 Occurred

parse error. not well formed

A malformed XML-RPC request can cause this error, but I don’t know of any way that can happen with Windows Live Writer 2008 Final. A more likely and sinister cause is what Gordon Dewis discovered:

Googling wordpress.net.in revealed a number of pages, including a blog entry by Avice De’vereux that described the symptoms and said they were caused by a spam injection hijack by wordpress.net.in. I think the hijack was supposed to insert ads in the page footers, but I don’t recall seeing anything there.

The solution seems to be to replace the modified files with fresh copies from WordPress.org and harden your WP install from future attacks.

It’s not clear to me how the files are getting modified in the first place. Are there malicious themes/plugins that are trojans, or is there an exploitable hole in WP or PHP? Most of the users who reported this to me lately have been on WP 2.3.2, the latest. If you have more information, please comment or pingback… thanks!

(In case there are client implementers who are reading this, another way to get some WP installations to cause this error is to create very large XML-RPC requests, such as those containing large Base64-encoded images, and format the XML without any line breaks. Under some versions of PHP you’ll get the error. The solution is to add line breaks.)



11 Responses to “"parse error. not well formed"”

  1. I’ve noticed the same ad-based errors on sites with free hosting – you know, like GeoCities style. They so clumsily inject their advertising into the user’s free web server, that they don’t bother to consider that they might be injecting an HTML ad at the top of an XML server reply.

    Thanks a lot for the tip about the Base64-encoded images. I think I’m sending mine up as a full no-newlines Base64 string. I just assumed the out-of-memory errors from the server had to do with the total length of the request. But you’re suggesting it has to do with the total length of the line? That is promising!

    Daniel

  2. Sorry, but out of memory *is* related to the total length of the request. I’m pretty sure it’s specifically “parse error. not well formed” that you get with the no-newlines error, and again, it’s only specific versions of PHP.

  3. Ah well – was hoping for a panacea🙂 Thanks for clarifying.

  4. I’m getting that error. Could you let me know how to correct it? Do I need to upgrade my WordPress install? Please advise. Thks!

  5. 5 Kissing Bandit

    MotR: Short answer? Yes.

    Current version (2.3.3) is a security release.

  6. Joe, thanks so much for documenting this. We just fixed a bug in Blogo which was due to this same issue.

  7. 7 Marco

    Joe,

    thank you, but it’s not working on WP 2.6.1. I cannot post using WLW. Get the same error message. According to MS, the logfile says it’s not WLW fault but WP fault.

    I disabled every single plugin, no change. I even re-installed WP (lot’s of work)… no change😦

    Any more suggestions? lol

  8. I’m use Iphone and I also have “parse error. not well formed” this problem too.

    How can I solve it and my WordPress for iPhone are Version 1.1

    I am disappointed as I am using WordPress write blog EVERYDAY!!

  9. 9 tim1

    Here’s a fix: your xmlrpc file could have a change in it. Check this thread at the forum for Ecto, the blogging tool.


  1. 1 gordon.dewis.ca
  2. 2 2 our allies » Slow Down

%d bloggers like this: